       (update-in [:vpc :security-groups] sort)))
 
 (defn remote-config->local-config [remote]
-  (let [remote (set/rename-keys remote {:function-name :name :vpc-config :vpc})]
-    (if-let [vpc (:vpc remote)]
-      (assoc remote :vpc
-        (-> vpc
-            (select-keys #{:subnet-ids :security-group-ids})
-            (set/rename-keys {:subnet-ids :subnets :security-group-ids :security-groups})))
-      remote)))
+  (let [remote (set/rename-keys remote {:function-name :name :vpc-config :vpc :dead-letter-config :dead-letter})]
+    (merge
+      remote
+      (if-let [vpc (:vpc remote)]
+        (assoc remote :vpc
+          (-> vpc
+              (select-keys #{:subnet-ids :security-group-ids})
+              (set/rename-keys {:subnet-ids :subnets :security-group-ids :security-groups}))))
+      {:dead-letter (get-in remote [:dead-letter :target-arn] "")})))
 
 (defn same-config? [remote local]
   (let [remote (-> remote remote-config->local-config normalize-config)
-        local  (-> local (select-keys fn-config-args) normalize-config)]
+        local  (-> (merge fn-spec-defaults local) (select-keys fn-config-args) normalize-config)]
     (= (select-keys remote (keys local)) local)))
 
 (defn- deploy-function!

    args/*region*      (assoc :region  (name args/*region*))
    args/*aws-profile* (assoc :profile (name args/*aws-profile*))))

(defn update-vpc-value [{:keys [vpc] :as fn-spec}]
  (if-not vpc
    fn-spec

(def lambda-cli! (partial aws-cli! "lambda"))

(def fn-config-args
  #{:name :role :handler :description :timeout :memory-size :runtime :vpc :dead-letter})

(def fn-spec-defaults
  {:vpc {:subnets [] :security-groups []} :dead-letter ""})

(def create-function-args
  (into fn-config-args
    #{:zip-file :output :query}))

(def update-function-code-args
  (remove #{:vpc :dead-letter} create-function-args))

(defn validate-fn-spec! [{fn-name :name vpc :vpc}]
  (let [subnets (:subnets vpc)
